THE GEORGE WASHINGTON UNIVERSITY 
Washington, D.C. 

MINUTES OF THE REGULAR MEETING 
OF THE FACULTY SENATE HELD ON 
MARCH 11. 2005 IN THE MARVIN CENTER. ROOM 310 


Present: Vice President Lehman and Parliamentarian Pagel; Deans Futrell, and Tong; 

Professors Biles, Briscoe, Englander, Gallo, Garris, Gupta, Marotta, Mueller, 
Robin, Robinson, Shen, Simon, Vergara, Wilmarth, and Wirtz 

Absent: Deans Frawley, Harding, Katz, Phillips, Scott, Trangsrud and Whitaker; 

Professors Castleberry, Cordes, Delaney, Friedenthal, Granger, Griffith, 
Helgert, Klaren, Lee, Packer, Shambaugh, and Watson 

The meeting was called to order by Executive Vice President for Academic Affairs 
Donald R. Lehman at 2:17 p.m. 

APPROVAL OF THE MINUTES 


Upon motion made and seconded, the minutes of the regular meeting of February 11, 
2005 were approved as distributed. 

CHANGE IN THE ORDER OF THE AGENDA 

Professor Wilmarth moved that the order of the agenda be changed so that 
consideration of Resolution 04/9 could take place following the Update on Academic 
Information Technology Security, the Report on the School of Engineering and Applied 
Science, and Remarks by the Vice President for Advancement. The motion was seconded 
and passed. 

UPDATE ON ACADEMIC INFORMATION TECHNOLOGY SECURITY 


Dr. David G. Swartz, GW’s Chief Information Officer thanked the Senate for the 
opportunity to present an update, and he distributed a report on GW Information Security : 
Services and Initiatives prior to the presentation. (The Report is attached.) 

Dr. Swartz began by saying that the purpose of the update was not only to raise the 
faculty’s awareness about Academic Information Technology Security, but also to request 
faculty assistance in implementing measures to enhance it. 

According to Dr. Swartz, inroads on computer systems made by hackers (those 
attempting to compromise technology security) are widely reported in newspapers and 
other media, often on a daily basis. Whether the target is an educational institution (George 
Mason University recently experienced a serious incident), a commercial firm, such as 
ChoicePoint, or an individual, the dangers of identity theft and compromised technology are 
ever-present and growing. Dr. Swartz reported his own recent experience with the Bank of 
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America, which notified him that a security breach requited them to cancel his accounts 
and reissue them, a process which took several days and could have caused severe hardship. 

The bad news is that, on the GW campus, the number of hacking attempts is 
growing exponentially. Every year, it gets worse because the Internet grows into other parts 
of the world where there are more and more creative minds with smaller and smaller 
incomes who view this as a way of making money. This is no longer an activity where the 
idea is to be clever and secure bragging rights; very creative people, now driven by 
capitalism, view this as a means of harvesting either information or money. Dr. Swartz 
added that this harvesting activity can work both ways, as the Bank of America sought to 
charge him $5 for the privilege of restoring his accounts. 

The good news is that the number of “successful hacks” and compromised boxes 
(computers, desktop computers, or servers) is fewer than before, thanks in large part to 
security measures now in place. 

Another area of potential vulnerability is keeping track of confidential data in GW’s 
technology universe. It is important to accurately identify and locate where this data is 
stored or accessed, and to audit and ensure that adequate security measures are in place to 
protect it. Dr. Swartz then introduced Guy L. Jones (M.S.S.M.), Chief Technology Officer 
at the University. 

Mr. Jones began by outlining the most common sorts of attempts to compromise 
technology security. These include the creation and dissemination of what are termed 
viruses and Trojans, which infect boxes and ultimately compromise their systems and 
networks. While the Information Technology (IT) Office used to log the number of these 
attacks, this became impossible once the number increased into the millions, so at this 
point IT keeps track of the number of compromised boxes, or successful attacks. 

Mr. Jones reported that most users are not aware that these attacks can and are being 
directed not only at boxes and networks, but at resident programs such as Microsoft Office 
and Word. Printers and fax machines can also be affected, and the day is coming when a 
user’s cell phone will be targeted to spread malicious programs to a box or network, and 

vice versa. 

Despite this bleak picture, there are tools to stop this sort of havoc, and IT offers a 
number of security options to the University community. These include: 

Antivirus Protection - available at no cost, as the University has obtained a 
site license to distribute Symantec Antivirus to the University community. 

Firewalls : While use of a personal firewall is strongly recommended and a 

free one is included with Microsoft Windows, an alternative Symantec product, available at 
no cost for download from the University HelpDesk provides better protection. While 
Microsoft’s product is user-friendly, it is not as effective as the Symantec product which, 
when installed, inactivates the Microsoft personal firewall. The firewall acts something like 
a blast shield, in that when a box is hacked, the compromised computer tries to initiate 
outgoing activity (such as harvesting data from a box or a network). A personal firewall 



Faculty Senate Minutes, March 11, 2005 


Page 3 


detects this outward-bound activity and pops up a flag that tells the user, often in 
convoluted code, that his/her computer is trying to perform a task, and asks if the user 
wants to do it. Unless the activity is initiated (and understood) by the user, the answer 
should be no. 


User Awareness : This is an absolutely essential component of secure 

technology. IT provides information through a number or channels, including fairs, written 
communications, and hands-on training for local support partners. 

Spyware : These programs, while not required, are useful to detect the 

presence of “bugs” and other malicious programs. Some of these are designed to attach to 
“cookies” so that when a user accesses a website, the semi-legitimate cookies, (which are 
used to track a user’s visit to the site) are tagged to carry back to the user’s box malicious 
information. Another form of mischief detected by spyware is when (for example) a weather 
map or clock for the desktop is downloaded from the Internet, which then loads malicious 
information on the receiving box. Sometimes so much is loaded which runs in the 
background of legitimate systems operating on the box that some older systems can actually 
be brought to a screeching halt. Two recommended free spyware products are available for 
download from the Internet: AdAware, or SpyBot. 

Patchlink : Available free on any Windows product, and highly recommended, 
Patchlink checks to make sure that operating and software system patches, and antivirus 
protection are current on boxes. Patchlink is a server which keeps a database of all the 
known patches of software, and it uses a software agent to push (or download patches) onto 
a user’s system automatically. Gelman Library has reduced the number of compromised 
boxes by adopting this system. 

Automatic Update : As its name implies, this can be turned on by the user, or 
this can be connected to an automated pushing system, a feature available on Patchlink. 

Professor Englander asked if an Email could be sent to all faculty setting forth an 
organized checklist of these measures. It would be helpful, he added, if such 
communications could list requirements or recommendations individually, rather than just 
advising users to go to the IT Security page. Mr. Jones responded that security Emails have 
been sent, but he would see that another is forthcoming with all of the hyperlinks. A 
training program is also being rolled out now for all incoming staff. 

Professor Robin said he thought in general that the Helpdesk Help Pages are pretty 
helpful, but it requires a lot of navigation for users to find what they are after. For example, 
in looking at the firewalls entry, the first information concerns the Windows native firewall, 
but users have to navigate further to get more comprehensive information. Each page is 
clearly written, but there is no priority of information. Mr. Jones thanked Professor Robin 
for this observation and said he would take this point under advisement. It is always 
helpful, he added, to receive suggestions for improvement in the information promulgated. 

Professor Wirtz said he agreed that security issues were serious and need to be 
addressed. However, the concept of having a program run on a faculty member’s machine 
which monitors that machine and then pushes down software automatically poses a 
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potential conflict with the provisions of Article II. of the Faculty Code if this is done without 
a faculty member’s active consent to such monitoring. [Article II provides that, “A faculty 
member shall enjoy freedom of investigation subject only to legal restrictions and such 
guidelines as shall be recommended by the Faculty Senate and adopted by the University.”] 

Professor Wirtz then asked what provisions are in place to ensure that the faculty can 
be involved before the decision to place this software on the individual’s machine is made, 
and will there be a provision by which an individual faculty member will have an 
opportunity to opt out ( not opt into) any plans to implement these sorts of programs before 
they are put in place. 

Mr. Jones said that ISS shares these same concerns, as within this shop there are 
technically-oriented users who do not want anything pushed down because it could break 
their operating systems. Thus the plan within ISS is to have tiers in which some users are 
pushed, and others are not. While still in the proof of concept stage, this model should work 
well with departments and Patchlink will not be extended outward without someone [such 
as a local support partner (LSP)] designated to support it. 

Professor Wirtz said he did not know if everyone in the room understands who the 
LSP’s are, but these are school-based administrative structures which implement 
technology within the Schools. He then asked if it was the case that under no condition 
would anything be pushed to or installed on any faculty member’s machine without that 
faculty member’s explicit concurrence, and secondly how is it that the faculty will become 
involved, as requited, in this decision if it is made by the LSP’s. 

Mr. Jones responded that there are no plans right now to push anything to anybody 
against their will, and that he was open to suggestions concerning the role of the LSP’s. He 
added that he was open to suggestion on ways to improve faculty involvement in decisions 
about academic technology security, and as discussed with the Senate Executive 
Committee, one way to do this might be to include Senate Members on the Research and 
Information Technology Committee (RITC). 

Professor Gupta said that some faculty are concerned that technology pushed to 
faculty desktops might be used to harvest information and send it elsewhere. Mr. Jones said 
that technically, the software now will not do that, but viruses and Trojans attempt to 
accomplish this, and may eventually morph into something that can function in this way. 

Professor Wilmarth noted that the Senate Executive Committee had discussed some 
of these issues with Dr. Swartz and Mr. Jones, and it was the view of the Executive 
Committee that one of the Standing Committees of the Senate should investigate how best a 
faculty-administrative partnership can be constructed to consider academic technology 

issues. 


Mr. Jones concluded his presentation by s ummarizing his main points: that the 
computing environment is getting worse as id these problems are becoming more visible, 
particularly to Congress; thus it is likely that regulations will in future require the University 
to take specific measures to protect the information it has. At present, ISS can provide 
advice, tools, training, and support. It is important to note also that there is no defense 
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against some of these new problems except awareness and reporting on the part of the user, 
which are important goals not only for ISS but the University community as a whole. 


REPORT ON THE SCHOOL OF ENGINEERING AND APPLIED SCIENCE 


Vice President Lehman welcomed Dean Timothy W. Tong by saying that his report 
would be the fourth in a series of Dean’s reports presented to the Senate which had 
previously been made to the Board of Trustees last summer. Dean Tong’s report, like the 
other Dean’s reports, focuses on strategic directions for the School of Engineering and 
Applied Science (SEAS) and describes development initiatives and priorities. 

Dean Tong thanked the Senate for the opportunity to make his report and he 
distributed a copy of his PowerPoint presentation. He began by outlining a snapshot 
covering the period Fall, 2000 through Fall, 2004, which included information on the 
School’s undergraduate and graduate enrollment, faculty, research and sponsored activities, 
and advancement efforts. The snapshot also outlined near-term goals for the SchooL 

Dean Tong reported that the goal of achieving an undergraduate enrollment of 700 
(an increase of 225 students) was shared by everyone in SEAS, but achieving these numbers 
would be a challenge even with the very close working relationship SEAS has achieved with 
the Admissions Office. The School has seen quite a bit of progress in increasing graduate 
enrollment, and this is due in large part to faculty who brought more funded research to the 
University, which allowed the School to hire more graduate research assistants. Faculty 
have also been successful in launching new off-campus programs. As an example, Dean 
Tong said that the School has established a Master’s of Science degree program in Taiwan, 
and at this moment, SEAS has more Taiwanese students in that country than it does at the 
Foggy Bottom campus. 

In terms of faculty positions, SEAS is on track to achieve its near-term goal of 100 
faculty, and has increased the number of faculty positions by 17. During the reporting 
period, SEAS faculty has more than doubled the School’s research expenditure, and Dean 
Tong said he thought the faculty deserve a lot of recognition for this achievement. 

In the Advancement area, SEAS exceeded its originally modest goal of raising $20 
million in 2004 when $43 million was raised. 

Looking forward, Dean Tong described the School’s Strategic Plan, which with 
Professor Garris’s leadership, won faculty approval in December 2002 by an overwhelming 
majority. The School’s vision is ultimately to become one of the top 50 engineering schools. 
This will be a challenge, as the School’s undergraduate programs are presently unranked 
and the graduate programs are ranked at 83 rd . However, in terms of research funding, SEAS 
makes a strong showing and is among the top 50 schools nationwide in this category. 

SEAS has made strategic investments in Selective Academic Excellence in three 
areas: T ransportation. Safety and Security; Information Technology and 

T elecommunications; and Biomedical Enginee ring , Despite the recent setback at the 
Virginia campus in the T ransportation area, strength in this area remains deep, and the 
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School has particular expertise, particularly in the area of automotive safety. Dean Tong 
said that although the Information Technology industry has suffered in recent years, he is 
convinced that this area will come back very strongly. In the area of Biomedical 
Engineering, the School is well-positioned with specific collaborations with colleagues in 
the Medical School, and a terrific new Hospital. 

Dean Tong then described Advancement priorities for SEAS. In order to achieve its 
goals, the School needs funding. On average, nearly 5% of faculty at the top engineering 
schools in the nation are members of the National Academy of Engineering (NAE). In 
order to attract five NAE members to the School’s faculty (which ultimately will number 
100), it will be necessary for SEAS to establish an endowment of approximately $4 million 
for each endowed professorship it wishes to establish, and the total price tag for this 
initiative will amount to $20 million. 

During the fall semester, 2004, SEAS recruited 117 freshmen, and this number will 
need to increase to 200 each year. Dean Tong noted that tuition at GW is already very high, 
and quite a number of engineering students come from middle income families. In order to 
attract more students, SEAS wishes to establish an additional 50 undergraduate merit 
scholarships which would contribute $20,000 toward each recipient’s costs. The total 
required to establish this program would be approximately $20 million. 

Finally, Dean Tong outlined the need for a new building for the Engineering School. 
The current facility is outdated, and the space for research is inadequate. While SEAS 
presently obtains twice as much in research funding as the allocated space would seem to 
allow, the School needs more space not only to maintain its high level of research 
expenditure, but to increase it. SEAS has managed over the years to achieve success in the 
research area because faculty are bright and committed, and the lack of adequate research 
space has tended to bend the direction of research toward the theoretical. Both theoretical 
and experimental research are necessary, noted Dean Tong, if the School is to achieve its 
goal of reaching the top 50. 

Dean Tong concluded his report by saying the School has an excellent and very 
hardworking Advancement staff, and he expressed confidence that the School can achieve 
its goals. He added that he was looking forward to working very closely with the 
University’s new Vice President for Advancement, Laurel Price Jones. (The Report is 
attached.) 

Professor Mueller remarked upon the impressive increase in faculty from 2000 to 
2004, on the order of 25%, and he asked where the money had been obtained to achieve this. 
He also asked what the percentage of tenure-accruing and tenured faculty was, as compared 
to the number of contract faculty in the School. Dean Tong responded that all 92 of the 
faculty referenced in his report are in the former category, and the school has roughly 100 
contract faculty. While most of the funding for these positions was derived from 
reallocation of existing resources. Dean Tong said that the Executive Vice President for 
Academic Affairs had also provided funding for this purpose. Vice President Lehman noted 
that before Dean Tong came to the University, there were very severe cutbacks in the 
number of positions in the Engineering School following a very thorough review at the 
Board of Trustees level. While the tenure lines present in the school at that time were never 
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taken away, they were left vacant, and all of the tenure lines that have been filled since Dean 
Tong came to GW already existed and were not new. Because of the School’s 
reorganization, reallocation of resources, and the productivity of its faculty. Vice President 
Lehman said that Dean Tong was given permission to refill those vacant tenure lines. 
Funding that was given to the School to fill some of the vacant lines came through the 
Signature program in the Strategic Plan for Academic Excellence. Dean Tong noted that, in 
connection with some of these reallocations, staff in the School is quite thin, and one of the 
associate dean positions has not been filled since his arrival, as funding for this purpose was 
used to fund a faculty position. 

Professor Briscoe asked the Dean to comment on plans to continue or increase 
activity at the Virginia campus. Dean Tong noted that two kinds of programs exist at this 
campus, open enrollment, and cohort programs. While cohort programs are doing well, 
SEAS is working toward launching a more effective marketing campaign to increase the 
number of students in the open enro llm ent category. 

While the University has decided not to build a new crash test facility, SEAS faculty 
are still highly regarded in the field, and they will expand their efforts in state-of-the-art 
computer simulation. A search for a new director for the National Crash Analysis Center is 
underway. In addition, the School’s Shift Table is now fully operational, and GW is 
pursuing joint research opportunities with the University of Maryland. 

Professor Briscoe asked if Dean Tong was aware that Loudoun County is now 
becoming a Biotech corridor. Dean Tong responded that as of now, the School does not 
have a Biomedical Engineering program at the Virginia campus, but effort in this area 
could be stepped up if funding becomes available. 

As one who has watched the remarkable transformation of the Engineering School in 
recent years. Professor Robinson said she thought that the Dean and the faculty have done 
an incredible job. She noted that undergraduate recruitment for the School has always been 
difficult, and she asked how much of the recruiting takes place at the School level and how 
much is conducted by the University’s Admissions Office. She also asked how more faculty 
involvement in recruiting could be achieved. Dean Tong responded that while the 
Admissions Office conducts the vast majority of recruitment activities for the School, faculty 
are becoming more involved in these activities which include open houses and recruiting 
travel. 

REMARKS BY VICE PRESIDENT FOR ADVANCEMENT LAUREL PRICE JONES 

Vice President Lehman introduced the University’s new Vice President for 
Advancement, Laurel Price Jones, who comes to GW from Rochester Institute of 
Technology (R.I.T.) in New York. Vice President Price Jones also was employed in 
fundraising at University Hospitals of Cleveland, associated with Case Western Reserve in 
Ohio. 

Vice President Price Jones thanked the Senate for the opportunity to address the 
faculty. Although she said she had been at GW only a few weeks, that had been enough 
time to begin to see where the focus of Advancement efforts should be directed. She noted 
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that Advancement encompasses not only fundraising, but Alumni Relations as well, as these 
areas are directly related. 

In terms of its fundraising over the past twenty years, Vice President Price Jones 
said, it is surprising that the University has not secured a gift, or several gifts, of $10 million 
or more. Given the size and stature of GW, it is time for the University to achieve that level 
of commitment, as gifts of that size have an impact not only on what the University can do, 
but upon its self-image and the image it projects to the community, which encourages 
potential donors to consider a higher level of giving. Vice President Price Jones added that, 
therefore, her first focus would be upon opening conversations with potential donors and 
finding that first eight-figure commitment. It takes about the same amount of time and 
effort to secure one of these large gifts as it does a smaller one, she noted. 

The second focus for Advancement efforts will be the development of Planned 
Giving arrangements, which include the designation of GW as a recipient of gifts in wills or 
trusts, the creation and use of charitable gift annuities, and other vehicles which will secure 
funds and deferred gifts. While these efforts will probably not produce gifts in the near 
future, they will pay off five to fifteen years from now at which point the wisdom of pursuing 
these types of donations will be obvious. 

Thirdly, Advancement will focus on streamlining fundraising through GW’s Annual 
Fund, to which all alumni and friends of the University are asked each year to contribute. 
GW’s r anking in US News and World Report depends in part (a very small part - 
approximately 5%) on the participation of graduates who earned their bachelor’s degrees at 
GW in this activity. At present the participation rate is 12%, and this rate has steadily 
declined in the past five years to that level from 20% in FY 2000. While a reduced level of 
participation over the past 10 years in this sort of philanthropic activity has declined 
nationwide, GW’s participation rate is much lower than that of its competitors. 

Vice President Price Jones commented upon the need for GW to take a high-level 
look at our sources of corporate donations and the Advancement Office plans to hire a staff 
member who will work solely on leveraging to a higher level all of the University’s corporate 
relationships. 

Finally, Advancement will be investing in development of the alumni database, as 
GW can only locate some 70% of its graduates. That number, she added, should be more 
like 90%. This effort will obviously impact the Annual Fund campaign. 

Vice President Price Jones spoke very highly of the staff in Advancement and Alumni 
Relations who have continued their work during a period in which leadership has changed 
several times. She then gave an overview of fundraising at GW over the last 5 years Over 
this period of time, on average, the amount of cash raised each year has been approximately 
$50 million; pledges have totaled $26 million, and deferred gifts $8 million. This year to 
date, despite transitional leadership, nearly $34 million in cash has been raised, with $11 
million in pledges and deferred gifts of $2 million. 
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In terms of fundraising goals. Vice President Jones said that a report written two to 
three years ago setting these goals pegged the goal for FY 2005 at $75 million, although it is 
unclear what would make this 50% increase in funds raised a reality. 

Vice President Price Jones then reviewed the sources in four categories of support for 
GW, with alumni giving on average 22% percent of funds raised, others such as interested 
individuals and friends, 11%, foundations, 45%, and corporations, 11%. While nationally 
alumni contribute an average of 28% of funds raised, GW’s fundraising from this source 
could use improvement but is not wildly out of line. In the category of “others” the national 
average is 21%. In the area of foundation support, GW’s average is some 20 percentage 
points higher than the national average, and in the area of corporate support, GW is 9% 
below the national average. 

Vice President Price Jones concluded by saying that overall, fundraising efforts will 
concentrate on working with corporations and individuals, with the latter effort aimed at 
achieving the 20% percent participation rate in place five years ago. She then offered to 
entertain questions. 

Professor Wirtz asked if the problem in the participation rate is that GW is not 
contacting individuals, or that perhaps potential donors are sending the University a 
message by their lack of participation in fundraising campaigns, and he asked if there is a 
mechanism in place to find out why al umni do not give. Vice President Price Jones 
responded that an annual survey will be instituted which will seek answers from a sample of 
alumni on this very question. She said that when this was done at R.I.T., they found that 
alumni thought R.I.T. was a great place that they would recommend, but when asked how 
important they thought fundraising was for the institution, it became clear that their low 
participation rate of 8% was due in large part to the fact that they just did not understand 
why R.I.T. needed money. Another initiative which will hopefully raise the participation 
rate is developing a program through Alumni Relations which will encourage students 
preparing to leave the University to t hink of themselves as alumni who will return to 
participate in and contribute to University life. 

Professor Gallo asked if the participation rate at R.I.T. had increased while Vice 
President Price Jones was there, and the Vice President responded that it had increased 
from 8 to 12%. 

Professor Wilmarth noted that tuition has gone up considerably in the last five years, 
and asked if the decline in Annual Fund participation was a reaction to this development. 
Vice President Price Jones said she thought that it was a bit early for fundraising tallies to 
reflect an effect like this with alumni from this group which had departed so recently. 

Professor Simon noted that it appeared that since the year 2000 there have been no 
new donors, and suggested that the University find out why these individuals chose not to 
give when asked. Vice President Price Jones agreed that there are probably many reasons 
for this which the University needs to discover. While the total amount of money given by 
regular donors may be relatively small and the costs associated with this sort of fundraising 
rather high compared to other sorts of campaigns, it is important to continue an outreach 
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effort to individuals who self-identify as donors and may be ready to make a larger, or 
deferred donation to GW. 


RESOLUTIONS 


RESOLUTION 104/91. “A RESOLUTION FOR THE APPROPRIATE 
REGULATION OF HONORS. AWARDS. OR DISTINCTIONS BY UNITS OF 
THE UNIVERSITY” 


On behalf of the Senate Committee on Honors and Academic Convocations, 
Professor Barry L. Berman, Acting Chair, introduced Resolution 04/9, and he thanked in 
particular the University Marshal, Jill Kasle, and Professor Walter K. Kahn for their help in 
constructing the Resolution. 

Professor Berman briefly reviewed the history of the Committee’s deliberations on 
the Resolution, which was prompted by an inquiry from Associate Vice President Jean 
Folkerts concerning awards being made in GW’s name by sub-units of the University. It 
was the consensus of the Committee that departments, or sub-units of Schools, institutes, 
centers, or individual faculty should not be authorized to confer such awards to persons 
outside the community of GW students, faculty, and staff, although these units could well 
suggest or initiate a process to be formulated by each School for conferring such awards. 
Following that procedure, Schools of the University (not including schools within schools) 
should be authorized to confer such awards subject to some authorized University process. 
The Committee also agreed that the sort of process already in place to review honorary 
degrees would be more or less appropriate for this kind of award as well. Professor Berman 
pointed out that the appendix to Resolution 04/9 sets forth the Committee’s proposed 
guidelines for evaluating the propriety of such awards. 

Professor Gupta said he thought that the provisions of Resolution 04/9 would apply 
to awards conferred upon persons outside the University, but the Resolution itself does not 
specify that, and he asked if the proposed procedures would apply to departments giving 
awards to undergraduate and graduate students, as the Mathematics department presently 
does. Professor Wirtz made the same observation, i.e., that the Resolution did not make 
this clear, and said he had the same question in mind. Professor Berman said the intent was 
that the proposal should concern awards made to persons outside the community of GW 
students, faculty, and staff. Professor Wilmarth suggested an amendment to the first 
Whereas Clause which would clarify this point, which was accepted as a friendly 
amendment by Professor Berman. Discussion followed between Professors Wilmarth, 
Gupta, and Englander on this point. 

Professor Simon asked that the definition of the GW community be further refined, 
as the School of Medicine and Health Sciences confers awards to individuals who do not 
hold faculty appointments, for example, ind ividuals who conduct medical rounds at Holy 
Cross Hospital. Discussion followed between Professors Berman, Gupta, Simon, and Vice 
President Lehman about awards to individuals outside of the defined co mm u n ity who have 
a relationship to the University. Professor Wirtz suggested that the definition of co mm u n ity 
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in the Resolution might be amended to include attending physicians, but this suggestion 
was not adopted and prompted further discussion. 

Professor Garris brought up the Engineering faculty’s practice of attending and 
judging high school science fairs, and the practice of giving to participants a certificate from 
the University for such participation. Further discussion followed by Professors Garris, 
Wilmarth, Berman, Wirtz, and Mueller on such practices. Professors Berman, Wilmarth and 
Wirtz expressed serious reservations about awards with the imprimatur of the University 
being conferred when the University had not assumed a formal role in this process. 
Professor Englander and Professor Simon then discussed a procedure whereby such awards 
might be vetted in principle by the Honors and Convocations Committee, with an 
authorization covering a class of such awards issued for same. 

Vice President Lehman asked Professor Wilmarth to restate his proposed 
amendments to the Resolution. Professor Wilmarth moved that in the first Whereas Clause 
after the words “George Washington University” on the second line the words “that is made 
to a person outside the community of GW students, faculty, and staff” be inserted, followed 
by the phrase “continue to deserve.” 

In the first Resolving Clause, Professor Wilmarth moved that immediately following 
the word, “that,” the phrase “with respect to persons outside the community of GW 
students, faculty, and staff” be inserted before the phrase “only Schools of the University.” 

In the second Resolving Clause, Professor Wilmarth moved that the word “such” be 
inserted between the phrase “that nominees for” and “school awards.” 

Professor Wilmarth then also suggested the Resolution might perhaps be amended 
to make clear that the process for these awards was a collaborative one which might involve 
consultation with a School’s Dean. 

Professor Briscoe asked if alumni were included in the definition of GW community, 
and Professor Wilmarth responded that they were not. 

Professor Wilmarth’s motion as stated was seconded. Further discussion followed at 
some length between Professors Englander, Berman, Simon, Wirtz, and Vice President 
Lehman. Following this discussion a motion to refer the Resolution back to Committee for 
further consideration of the suggested amendments was made and seconded. The question 
was called on the motion, a vote was taken, and the motion passed. 


INTRODUCTION OF RESOLUTIONS 


No resolutions were introduced. 
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GENERAL BUSINESS 

I. NOMINATION FOR ELECTION OF MEMBERS OF THE NOMINATING 
COMMITTEE FOR THE EXECUTIVE COMMITTEE FOR THE 2005-06 
SESSION 


Professor Wilmarth moved the nominations of the following faculty members for 
election to the Nominating Committee: Professor Philip W. Wirtz (SB), Convener; 

Professors William J. Briscoe (CCAS), Kurt J. Darr (SPHHS), Linda L. Gallo (SMHS), Peter 
F. Klaren (ESIA), Sylvia A. Marotta (GSEHD), Walter K. Kahn (SEAS), and Arthur E. 
Wilmarth, Jr. (GWLS). The slate of nominees was approved. 


II. REPORT OF THE EXECUTIVE COMMITTEE 

Professor Wilmarth presented the Report of the Executive Committee, which is 
enclosed. 

BRIEF STATEMENTS (AND QUESTIONS! 

Professor Englander asked Vice President Lehman if there was any news on the 
effort to unionize part-time faculty at the University. Vice President Lehman responded 
that thus far the eagerly anticipated decision of the Administrative Law Judge in this matter 
has not been received by the University. 

Professor Wilmarth advised the Senate that Executive Vice President and Treasurer 
Louis H. Katz and one of his associates would attend the Executive Committee meeting on 
March 25 to give an update on planning for the development of Square 54 (the old GW 
Hospital site). He added that if there is important information coming out of that update, 
the Executive Committee would encourage Vice President Katz to share this information 
with the Faculty Senate at its meeting on April 8. 

ADJOURNMENT 

There being no further business before the Senate, a motion to adjourn was made 
and seconded. The meeting was adjourned at 4:43 p.m. 


Elizabeth/ A. AmuricU&vv 

Elizabeth A. Amundson 
Secretary 






Washington oc 


GW Information Security: 
Services and Initiatives 


Summary 

While Information Systems and Services (ISS) has gone to great lengths to protect information 
stored in and transmitted to and from its major systems (e.g., Banner, Enterprise Accounting 
System, GWMail), risks of unauthorized access to other GW systems, and to information stored 
on paper, remain high. Security breaches at other higher education institutions — most recently 
at George Mason University, where a hacker accessed Social Security Numbers on a 
department-maintained server — illustrate the risks of identity theft, invasion of privacy, and data 
tampering when information is not secured. 

This document discusses the need for protections of University data, and describes currently 
available services as well as projects underway to ensure maximum protection of information. 


Background 

Importance of Protecting University Data 

Security breaches at higher education institutions have intensified concern about information 
security — concerns of parents, students, federal entities and employees. In the mid-Atlantic, the 
most recent event occurred at George Mason University, where an insufficiently secured server 
was compromised. ISS records show a continuously increasing frequency of intrusion attempts, 
and increasing sophistication of those attempts. 

At any point in time, GW departments’ essential information is located in several places: 

- on paper 

* on desktops 

■ on servers maintained in the ISS Data Centers 

* on servers maintained by GW departments 

* on the GW network, transmitted between desktop and server, or between servers 

For unsecured information, whether stored electronically or on paper, the risks we incur from 
unsecured information include: 

= violation of individual privacy 

■ identity theft 

■ corruption of GW data 

■ disruption of automated processes that sustain the University’s operations 

Because our data are located in a variety of locations and media, protecting them requires that 
security measures be applied to paper, desktop computers, servers, and the network. 
Furthermore, since data are owned, stored, and used by all GW departments and community 
members, all departments have responsibility for protecting those data. 

Relevant Policies 

The GW Data Classification Policy, approved by University Vice Presidents in Fall 2004, 
acknowledges and emphasizes the cross-University responsibility for protecting data. The policy 
also provides definitions for categories of information— Public, Official Use Only, and 
Confidential — and provides guidelines for protecting these different categories. 
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The Information Security Policy, approved in Spring 2004, provides information on security 
requirements. The policy states that systems— including desktop computers— should be kept 
patched and protected from viruses. The policy also strongly recommends usage of personal 
firewalls. 

For systems that contain confidential and/or sensitive information (e.g., social security numbers, 
academic records), the Information Security Policy states that encryption technology and other 
enhanced security measures should be applied. The types of protections depend to some extent 
on the system’s technology underpinnings and the types of information maintained. ISS has a 
project underway to secure department-maintained servers (see Server Information Security 
Project, below). Also, ISS is available to advise departments on securing servers and desktops. 


Related Services and Projects 

Services Currently Available to the GW Community 


Generally, software vendors provide operating system patches and software patches at no 
charge for licensed users and valid operating systems. 

ISS currently offers the following services and products to support compliance with information 
protection policies: 

* Antivirus software: GW has a site license for Symantec Antivirus, available at no 
charge to GW community members. 

■ Desktop firewall: Use of personal firewalls on desktops is strongly recommended. GW 

has a site license for a Symantec product, available at no charge to the GW community. 

» Extra security mechanisms for wireless computing: ISS requires and provides 
“virtual private network” technology to encrypt wireless transmissions. 

- Security Toolkit: ISS has published a manual for server administrators, which offers 
specific process and a documentation template for securing department-maintained 
servers. 

Projects Underway to Enhance Information Protection 

ISS is conducting several projects to improve protection of GW information from unauthorized 
access, tampering and theft. Several of these efforts will feature additional products to 
incorporate into community members’ desktop technology configurations. 

Patchlink 

Patchlink is a software product that monitors and reports currency of a system’s operating system 
patches, software patches, and antivirus protection. Gelman Library has installed this software 
on its desktops, and has seen a marked drop in the incidence of desktop viruses since the 
installation. ISS is now working with ResNet to evaluate Patchlink for student residents’ 
machines, with the goal of being able to begin this program for students in residence halls in Fall 

2005. 

ISS plans for Patchlink to be available to other administrative and academic departments 
beginning in late summer or fall 2005. Deans and Department heads, in conjunction with their 
Local Support Partners (LSPs) will decide whether to use the product. 


Page 2 



GW Information Security: Services & Initiatives 

March 11, 2005 


Cisco Clean Access Solution 

“Clean Access” is a product that checks for existence of up-to-date antivirus protection and 
patches on a desktop before permitting it to connect to a network. ISS is working on configuring 
this product to incorporate the “intrusion protection” capabilities that are currently in place for 
wireless computing, thus enhancing desktops’ protection against attacks originating from outside 
the University. Clean Access will require either a login or a desktop scan before permitting a 
desktop’s connection to the GW network. 

ISS will install Clean Access for students in residence halls in Fall 2005. Expansion of the 
project to other GW community members is pending approval of additional funding; if funding 
becomes available, deployment of Clean Access will be initiated upon request of a department. 


SSN Protection Project 

Social Security Number is the de facto identifier for individuals at many institutions, but it is also a 
key to a wealth of financial information and other confidential information about an individual. 
Recent instances of SSN theft at other institutions, increasing frequency of concerns expressed 
by parents and students, and increased federal attention on use of SSNs as identifiers ISS all 
indicate that GW must consider conversion to a non-SSN individual identifier for general use, 
restricting access to SSNs to those processes that explicitly require an SSN (e.g., financial aid 
and payroll processes). 

ISS and Gelman Library are jointly conducting an analysis of current use of SSNs across GW 
departments, distinguishing those practices that must store and transmit SSN information. In 
early summer 2005, the project team will produce recommendations for the scope and schedule 
of a conversion to a non-SSN GW ID, as well as additional measures to secure SSN data. 


Document Protection 

The Office of the Executive Vice President & Treasurer is working with GW departments to 
identify and implement storage and disposal procedures for documents that contain confidential 
and “official use only” information, following guidelines stated in the Data Classification Policy. 
The project is in the information-gathering stage at this time. 

Virtual Private Network (VPN)A Virtual Private Network is a technology that (1 ) helps 
ensure that only authorized GW community members access University servers on campus, and 
(2) provides a secured path for community members to access GW systems from remote (off 
campus). ISS is working with individual GW departments in turn to install VPN software, giving 
highest priority to departments that have staff who need to access enterprise systems (e.g., 
Banner, EAS) from remote locations. 


Server Information Security Project 

The goal of this project is to secure information on servers that are owned and maintained by GW 
departments and schools. ISS is currently in the process of contacting administrators of 
department- and school-owned servers, to assess the security protections and recommend and 
install corrective measures to ensure that confidential and/or official data are protected from 
outside access. 
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Snapshot 



Fall 2000 

Fall 2004 

NEAR 

TERM 

GOAL 

UG enrollment 

430 

475 

700 

G enrollment 

1360 

1659 

t35/yr 

Faculty 

75 

92 

100 

Res & Sponsored Activities 

$9M 

$19M 

$20M 

Advancement 

$12M 

$43M 

$20M 




t * 






Strategic Investments 
in Selective Academic Excellence 


Critical Infrastructure in 
Information Technology 
(CS, ECE) 



IT/Teiecom (•■ Biomed 


Trans/Safety 
✓ & Security 



Excellence in Transportation 
Safety and Security 
(CEE, MAE, EMSE) 


GW Institute for 
Biomed. Engr 
(CS, ECE, MAE, and 
SMHS) 


Endowed Professorships 

• Top 30 to 50 engineering schools have an 
average of about 5% of their faculty that 
belong to NAE 

• Five NAE members among 100 professors 
in the School 

• Cost - $200,000/yr payout requires an 
endowment of approximately $4M 

• Five endowed professorships require $20M 




Undergraduate Merit Scholarships 

*117 freshmen for fall, 2004 

• Need to reach 200 freshmen each year 

« Establish 50 additional top merit 
undergraduate scholarships to attract 
students 

• Cost - $20,000/yr payout requires an 
endowment of approximately $0.4M 

• 50 merit scholarships require $20M 


New Engineering Building 

• Current facility is outdated - Need modern 
facility to attract students 

• Inadequate space for research - reach 
saturation when research expenditures 
reach $300 per sq ft of research space, at 
GW usage is $700/sq ft 

• Combined education and research needs 
require additional space 

• Cost - 100,000 sq ft @ $400/sq ft = $40M 




Academic Advancement 


Gap 

Endowed Professorships: 

$20M 

Undergraduate Merit Scholarships: 

$20M 

New Engineering Building: 

$40 M 

Graduate Fellowships: 

??? 


Thank you very much! 


Timothy W. Tong 

Email: tong@gwu.edu 

Tel: (202) 994 6080 

School’s Website: www.seas.gwu.edu 




REPORT OF THE EXECUTIVE COMMITTEE 
Arthur B. Wilmarth, Jr., Chair 
March 11, 2005 

ACTIONS OF THE EXECUTIVE COMMITTEE 

)nint Wnfkina Ormip to Prepare a Final Policy and Procedures on Sexual Harassme nt 
Complaints 

This joint group held its first meeting on March 10. Further meetings ate scheduled 
between March 21 and April 19. We are hopeful that a consensus document can be agreed 
upon and reviewed by the Senate Committee on Professional Ethics and Academic Freedom 
so that the Faculty Senate can act upon the consensus document at its meeting on May 13. 
The Board of Trustees has asked the Administration and the Faculty Senate to present a 
final policy and procedures for the Board’s review at its upcoming meeting on May 19-21. 

Joint Working Group on the Potential Advanta ges and Disadva ntages of a 4x4 

Undergraduate Curriculum 

As previously reported, the Faculty Senate Executive Committee appointed 
Professors Edward Cherian, Robert Dunn, Roger Lang and Joseph Pelzman to serve on this 
joint working group in December 2004. The remainder of the joint working group has not 
yet been appointed by Executive Vice President Lehman, and the group therefore has not 
held any meetings. At its meeting in February, the Board of Trustees requested that the 
Administration present a report on the concept of a 4x4 undergraduate curriculum at the 
Board’s meeting in October 2005. In a recent communication sent to Executive Vice 
President Lehman, the Executive Committee has stressed the importance of providing 
faculty representatives on the joint working group and the Faculty Senate with reasonable 
time to consider the potential merits and shortcomings of a 4x4 undergraduate curriculum, 
and to present their recommendations, before the Administration delivers any final report 
to the Board of Trustees. Executive Vice President Lehman has assured the Executive 
Committee that faculty representatives on the joint working group and the Faculty Senate 
will be given a reasonable time period to consider any 4x4 proposal and to present their 
recommendations regarding such a proposal. 

University Faculty Club 

The Executive Committee has suggested that the Administration publicize to the 
University community the University Faculty Club’s decision to rescind its former 
membership and dues requirements and to allow University constituents to purchase meals 
at the Club by using cash or credit cards. 

PERSONNEL MATTERS 

I am pleased to report that no faculty grievances have been filed with the Dispute 
Resolution Committee since the date of my last report, and no faculty grievance is currently 
pending. 



GENERAL ANNOUNCEMENTS 


Please note that two items ate being distributed to you today: (1) the Faculty Senate 
Report presented to the Academic Affairs Committee of the Board of Trustees at its meeting 
i*i February; and (2) the Special Report on FY 2005 Five-Year Operating and Capital 
Budgets prepared by the Fiscal Planning and Budgeting Committee, which was attached as 
an exhibit to the foregoing Faculty Senate Report to the Academic Affairs Committee. 

APRIL SENATE MEETING 

On March 25, 2005, the Executive Committee will meet to establish the agenda for 
the Faculty Senate’s meeting on April 8. The Election of the Chair and Members of the 
Executive Committee for the 2005-06 session of the Senate will take place at the April 8 
meeting. Please note that the annual photograph of the Senate will also be taken at the 
April 8 meeting. In addition, the Executive Committee will propose to the Senate a list of 
nominees for membership on the Dispute Resolution Committee and Administrative 
Committees. 

If you wish to present resolutions, reports, or any other matters for consideration by 
the Senate on April 8, please submit them to Ms. Sue Campbell, Faculty Senate Coordinator, 
prior to March 25. 

Respectfully submitted, 

Arthur E. Wilmarth, Jr. 

Professor of Law 

Chair, Faculty Senate Executive Committee 



THE GEORGE WASHINGTON UNIVERSITY 
Washington, D.C. 

The Faculty Senate March 3, 2005 

The Faculty Senate will meet on Friday, March 11, 2005, at 2:10 p.m., 
in the Marvin Center, Room 310. 


AGENDA 


1. Call to order 

2. Approval of the minutes of the regular meeting of February 11, 2005, as distributed 

3. Resolutions 

A RESOLUTION FOR THE APPROPRIATE REGULATION OF HONORS, 
AWARDS, OR DISTINCTIONS BY UNITS OF THE UNIVERSITY (04/9); 
Professor Barry L. Berman, Acting Chair, Honors and Academic Convocations 
Committee (Resolution 04/9 is attached) 

4. Introduction of Resolutions 

5. Update on Academic Technology Security: Chief Information Officer 

David W. Swartz and Chief Technology Officer Guy L. Jones (Information attached) 

6. Report on the School of Engineering and Applied Science: Dean Timothy W. Tong 

7. Remarks by Vice President for Advancement Laurel Price Jones 

8 . General Business: 

(a) Nominees for election to the Nominating Committee for the Executive Committee for 
the 2005-06 Session (nominees to be announced) 

(b) Report of the Executive Committee: Arthur E. Wilmarth, Jr., Chair 

9. Brief Statements (and Questions) 

10. Adjournment 




Elizabeth A. Amundson 
Secretary 



A Resolution for the Appropriate Regulation of Honors, Awards, or 
Distinctions by Units of the University (04/9) 

WHEREAS, it is of the first importance that any honor, award, or distinction linked with the 
name of The George Washington University continue to deserve the high regard of the entire 
academic community and the world at large; and 

WHEREAS, it is essential therefore that such honor, award, or distinction be conferred with due 
deliberation on individuals or associations properly deserving of that honor, award, or 
distinction; and 

WHEREAS, to that end it is desirable that in the conferral of such honor, award, or distinction a 
degree of uniformity in standards, criteria, and deliberation be maintained throughout the 
University; NOW, THEREFORE 

BE IT RESOLVED BY THE FACULTY SENATE OF THE GEORGE WASHINGTON 
UNIVERSITY: 

1) That only Schools of the University should be authorized to confer honors, awards, or 
distinctions (that is, not individual Departments or other academic subdivisions, 
Institutes, or Centers, or other components, including ‘schools within Schools’, although 
these could well suggest or initiate consideration of such), subject to some appropriate 
procedures to be established by and within each School for that purpose, such procedures 
to be approved by the Executive Vice President for Academic Affairs; and 

2) that nominees for School awards should be vetted and approved by the Committee on 
Honors and Academic Convocations of the Faculty Senate on the basis of materials 
submitted in support of the honor to be conferred by the School, much as that Committee 
now vets nominations for the award of honorary degrees submitted by the various 
Schools. 

Appendix: Guidelines for Conferral of Honors, Awards, or Distinctions 

1) The awardee must have achieved distinction in his or her profession. “Distinction" can be 
measured in a variety of ways: winning significant prizes for professional or scholarly work; 
achieving national or international recognition for professional or scholarly work; or displaying 
the kind of professional or scholarly skills or abilities, character, and integrity that might cause 
the nominee to be considered to be a role model for students. 

2) The awardee must have made the kind of contribution to his or her profession that has 
measurably enhanced or improved the profession. The awardee must have set a new standard for 
accomplishment, found new ways to deliver the benefits of the profession, or otherwise brought 
recognition to the profession. 

3) A connection with GW and the School proposing the honor, award, or distinction would be 
an important positive factor. 

Committee on Honors and Academic Convocations 
Barry L. Berman, Acting Chair 
February 16, 2005 
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To: GWU Faculty Senate Members 

From: Arthur E. Wilmarth, Jr., Chair 

GWU Faculty Senate Executive Committee 
Re: GWU Information Security Policy 

On Friday, February 25 th , 2005, the Faculty Senate Executive Committee met with Mr. David 
Swartz, Chief Information Officer, and Mr. Guy Jones, Chief Technology Officer, in anticipation 
of Mr. Swartz’s upcoming presentation to the full Senate on Friday, March 1 1 th , 2005. The 
Executive Committee felt, and Mr. Swartz agreed, that shanng the following questions (posed by 
the Executive Committee) and answers (provided by Mr. Swartz) would be appropriate to 
inform the Senate about the underlying issues involving Information Security Policy. 

(1) What generic types of computer programs are currently mandated on all 
academic machines under the University academic technology policy (...a copy 
of any such policy would be very helpful) . 

The security software requirements and recommendations can be found in the 
information Security Policy. A copy can be accessed from: 

http : //my . gwu . edu/f i les/policies/InformationSecurityPolicy . pdf 

For systems that contain confidential and/or sensitive information such as 
social security numbers, educational records, and credit card numbers as 
examples, encryption technology and enhanced security measures is required. 

The Information Security Policy states that systems should be patched and 
anti-virus software used. Operating system patches and software patches are 
generally freely available from the manufacturer for valid operating system 
and software licensed users. The George Washington University has a site 
license for antivirus software (Symantec) that is freely available to 
faculty, students, and staff. 

The Information Security Policy highly recommends the usage of personal 
firewalls but does not mandate the use of it. GW has a site license for 
Symantec AV Corp Bdition 9.0.2 + Firewall 7.0.2 available from 
http : /'/helpdesk . gwu . edu/sof tware/ down load, html . 

(2) How, and when, were the mandates cited in (1) approved by a 
representative, elected Faculty body and what is the relationship of that 
body to the Faculty Senate; 

The Information Security Policy went into effect on April 21, 2004. The 
policy was reviewed by the ISS Policy committee, the AITC (Administrative 
Information Technology Committee) and the RITC (Research and Instructional 
Technology Committee) . The document was also developed after significant 
discussions with departmental LSP representatives. 

(3) Does current academic technology policy require specific vendors 

(e.g. , ‘Semantec* antivirus checker) or does the policy prescribe only generic 
categories (e.g., "you must have a virus checker on your machine") 

The Information Security Policy does not require specific vendors product. 

Faculty Senate Office 
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However, GW has a site license for anti-virus and personal firewall software 
that is available from the helpdesk website. It must be noted that ISS will 
only provide support to approved software listed under 
h ttp : //helpde s k. . gwu . edu/sof tware/ supported . html . 

(4) Does the University have site licenses for *all* mandated software 
identified in (1) , and if so, could you provide the ‘specific* URL to access 
and download that software 

Yes, for the desktop. Desktop software is available at the ISS helpdesk 
website for download at http://helpdesk.gwu.edu/software/download.html. 
However, the Security Policy states that sensitive and/or confidential 
information must use encryption technologies and other safeguards beyond what 
is needed for the desktop. SSH and VPN clients (for wireless) is available to 
encrypt the transmission of sensitive and/or confidential information. 

Other measures are targeted toward the use of sensitive information on 
servers. These measures fall under best practice and vary for each type of 
computer platform. Desktops should not be used to provide open access to 
sensitive and/or confidential information. Use of a desktop as a server would 
require that it follow guidelines for server use to include having a 
designated system administrator. 

(5) What procedures are in place, or are proposed, to ensure Faculty 
compliance with academic technology policy, and are these procedures fully 
consistent with the Faculty Code 

Compliance with security recommendations at the desktop for the faculty is 
not monitored today. Instead we use Intrusion Detection and Prevention 
Systems to monitor malicious traffic such as worm and virus activities. 
Desktops that are compromised are. referred to the local LSP for rebuild. If 
the identified desktop compromise is not corrected the desktop is removed 
from the network after one week. 

There are two projects in place to ensure desktop compliance 'with the 
security policy. 

Pat chi ink is currently being tested by ISS users to verify anti-virus 
software installation and operating system and software patch update level. 
This software has been successfully used by Gelman library staff to almost 
entirely eliminate their desktop virus/Trojan problem. ISS is now working 
with ResNet to deploy the Patch! ink product to the student residents for the 
2005 Fall semester. We are also working with departmental LSPs to provide 
this service later this summer or fall to the departments for voluntary use 
but our first priority is the student residence halls. Each LSP will 
determine whether to use Patchlink based on their needs and desires of their 
Deans /Department heads. 

The Cisco Clean Access Solution Initiative is the second program that will be 
deployed to the student subnets this fail. Clean Access requires that a user 
either log into the network or have their desktop scanned prior to being 
allowed full access to the Internet. 

3y implementing these programs to verify that the security policies are 
implemented and are working effectively we can reduce the incidence of 
compromise of University desktops . Patchlink and Clean Access Scanning serve 
as the verification piece. 

The Faculty Code states that "Faculty shall enjoy the freedom of 
investigation subject only to legal restrictions and guidelines as shall be 
recommended by the Faculty Senate, and adopted by the University". 
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The University is required bv regulation and board mandate to maintain an 
adequate level of security i.e. due diligence and due care to minimize 
negligence claims against the University due to crimes such as Identity Theft 
and the Invasion of Privacy from stolen information. 

The implementation of the security technologies listed under question 1 and 
found in the Information Security Policy (Patches, Encryption, Antivirus 
software, personal firewalls (recommended)) are seen as a privacy enabler for 
students, staff, and faculty members . Without these security technologies , 
true px'ivacv can not exist as the desktop computers are left open to hacker 
attacks and intrusions. 

(6) What generic types of computer programs beyond those currently mandated 
is ISS proposing to mandate on all academic machines 

The Patchlink and Clean Access projects are targeted at the student residence 
halls this fall. Patchlink will be made available to academic departments for 
voluntary use this summer. Patchlink requires the participation of the 
department IT support group to identify users and provide administrative 
management . 

(7) As a specific corollary to (6) , is there (or is it contemplated that 
there will be) a proposal to place any kind of program (active or passive) on 
each Faculty member's computer to ensure compliance with academic technology 
policy 


Patchlink and Clean Access will be available for expanded use in the future. 
It is envisioned that ISS will work with the academic or administrative 
departmental LSPs on which, if either, of these projects would be appropriate 
in their areas. The Patchlink solution in particular requires direct 
participation of the group providing desktop support. Clean Access has not 
been funded beyond the student subnets. 

If the answer to (7) is yes: 

(8) What is/are those proposed programs? 

1. Patchlink on a department by department voluntary basis 

2. Cisco Clean Access Solution, (unfunded) 

(9) Under the proposal, what is their scope? 

Student subnets will be covered by both projects this fall. Participation by 
other academic and administrative departments will be coordinated on a 
voluntary basis. ISS and Gelman library are already using the Patchlink 
solution . 


(10) Under the proposal, what is the timetable for implementation? 


Patchl ink Implementation : 

Gelman Library Staff and ISS Staff 
Students 

Departments on voluntary basis 


11/04 thru 5/05 
08/05 forward 
05/05 forward 


Clean Access: 

Student subnets 

Other departmental subnets 


08/05 

unfunded 
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(11) At what other universities has a proposal such as this been universally- 
adopted and implemented with respect to the *Faculty*; 

Approximately 140 higher education institutions have adopted the Cisco Clean 
Access Solution. We contacted a reference set of Universities to compare how 
they implemented their solution. 

The normal implementation 'was for student subnets, wireless and public 
connections. The reference universities have not implemented a universally 
adopted solution with respect to Faculty. However, some universities listed 
are planning to include Faculty in future implementations and are beginning 
discussions with faculty. 

Reference Universities : 

Stanford University 
Fordham University 
University of Mary Washington 
University of Cincinnati 
James Madison University 
Arizona State University 

(12) Under the proposal, will the proposed resident program(s) be capable of 
making any changes to a Faculty member's machine without his/her knowledge 
and/or concurrence, and if so, what is the proposed scope of those changes? 

Patchlink is capable of 'pushing' patches down to each desktop. The initial 
rollout to the student subnet will be set to monitor anti-virus and patch 
level. Gelman now 'pushes' patches to its system and ISS is using a mix of 
monitor and push depending on type of desktop. 

Clean Access will also monitor the existence of anti-virus and patch level 
before allowing access to the network. There is an additional capability to 
allow access after logging in without scanning. Clean Access does not 'push' 
but can redirect the user to a website to download the required software. 

(13) Under the proposal, would an individual Faculty member have the option 
of declining to have such a resident program operating on his/her machine, 
and if so what would be the implications of opting to decline; 

a. ) The implementation of Patchlink will be dependant on the departmental LSP 
/ management, decision. Policies on use will be made by the department. 
Patchlink requires the direct participation of the desktop support group. 

b. ) Clean Access is currently not funded beyond the student subnets. If 
funding becomes available it is envisioned that the entire network will be 
covered. Clean Access has the ability to exclude individual systems and 
allowing network log-in for full Internet access. 

(14) Under the proposal, in what way would the Faculty (as a group) actively 
participate to ensure that such any such resident program is limited to 
exactly, and only, the tasks consigned to it and approved by the Faculty; 

The technical coordination of these projects rests with departmental LSPs. 
They have the knowledge of who and where the faculty are and what their needs 
and requirements are. ISS is striving to provide flexible solutions that can 
be used in partnership with the departments to provide cost effective 
protection . 

Each of these solutions depends on the active participation of each 
department's IT support group to manage and deploy. 
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